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CLAIMS 

i 1. (Currently Amended) In a distributed network of interconnected 

computing devices, a network virus/worm monitor, comprising: 
a network worm sensor; and 

a traffic controller in communication with the network virus/ monitor worm 
sensor and the network operable in a number of modes wherein in a first mode the 
bandwidth of the network is substantially unaffected by the traffic controller 
during a virus/worm sensing operation by the network virus/worm sensor wherein 
when the network virus/worm sensor detects a computer virus or a computer worm 
in network traffic, the virus/worm sensor causes the traffic controller to switch to a 
second mode such that only those data packets infected by the detected computer 
virus or computer worm are not returned to the network. 

j 

2. (Original) A monitor as recited in claim 1, wherein those data packets 
deemed to be infected by the identified computer virus or computer worm are 
forwarded to a virus/worm analyzer unit coupled to the network computer 
virus/worm sensor. 

3. (Original) A monitor as recited in claim 2, wherein in the first mode, 
substantially all data packets included in the network traffic are copied by the 
traffic controller. 

I 4. (Original) A monitor as recited in claim 3, wherein substantially all of the 

i 

copied data packets are forwarded to the virus/worm analyzer unit. 

6 



'PAGE 8/17 * RCVD AT 2/2012007 8:08:43 PM [Eastern Standard Time] • 8VR:U8PTO-EFXRF-aM " DN18:2738300 * C8ID:612 252 3366 * DURATION (mm-SS):05<l4- 



FromrCASCADE MORTGAGE 



612 252 3366 



02/20/2007 19:06 #065 P. 009/017 



5. (Original) A monitor as recited in claim 4, at the virus/worm analyzer 
unit» the copied data packet is forwarded to a packet protocol determinator that 

I determines if the packet protocol of the copied data packet is one Likely to be 

i 

infected by the detected computer virus or computer worm. 

6. (Currently Amended) A monitor as recited in claim 5, further 
comprising: 

i a trash collector arranged to receive those copied data packets determined to 

i 

be of €t a first set of one or more protocols, not Lik e ly to bo infootod by tho 
dotooted oomputor virus or comput e r worm ; 

a filescan unit arranged to receive and analyze those copied data packets 
determined to be of a specific protocol likely to bo infected by the detected 
computer virus or computer worm. 

7. (Original) A monitor as recited in claim 5, further comprising: 

a virus/worm analyzer unit arranged to determine if those copied data 
packets received at the filescan unit are infected by the detected computer virus or 
computer worm wherein those packets determined not to be infected are forwarded 

i 

to the trash collector; 

a virus analysis unit arranged to analyze the infected copied data packets; 

and 

a virus report module arranged to generate a virus report based upon the 
analysis. 

7 
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8. (Original) A monitor as recited in claim 2, wherein in the second mode, 
only those original data packets included in the network traffic suspected of being 
infected by the detected computer virus or computer worm are forwarded by the 
traffic controller to the virus/worm analyzer unit. 

9. (Currently Amended) A monitor as recited in claim 8, at the virus/worm 
analyzer unit, the original data packet is forwarded to a packet protocol 
determinator that determines if the packet protocol of the a copied data packet is 
on e likely to be infected by the detected computer virus or computer worm. 

10. (Currently Amended) A monitor as recited in claim 9, further 
comprising: 

a network interface arranged to return to the network traffic only those 
original data packets determined to be of a second set of protocols not likelv to bo 
infooted by th e deteotcd computer virus or comput e r worm, wherein the filescan 
unit receives and analyzes those original data packets determined to be of a second 
set of protocols, lik e ly to be infooted by the dotootod oomputor viruo or oomputor 
worm . 

11. (Original) A monitor as recited in claim 10, wherein the virus/worm 
analyzer unit determines if those original data packets received at the filescan unit 
are infected by the detected computer virus or computer worm wherein those 
packets determined not to be infected are forwarded to the network interface for 
return to the network traffic and wherein the virus analysis unit analyzes the 
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infected original data packets and the virus report module generates a virus report 
based upon the analysis. 

12. (Original) A monitor as recited in claim 1, wherein the first mode is an 
inline mode and wherein the second mode is a standby mode. 

13. (Currently Amended) In a distributed network of interconnected 
computing devices, a method of managing network traffic by a network virus/worm 
monitor, having a network virus/worm sensor, comprising: 

during a virus/worm sensing operation, the bandwidth of the network is 
substantially unaffected by th e traffic controll e r by the network virus/worm sensor 
in a first mode wherein when the network virus/worm sensor detects a computer 
virus or a computer worm in network traffic; and 

switching when a computer virus or computer worm is detected to a second 
mode such that only those data packets infected by the detected computer virus or 
computer worm are not returned to the network. 

14. (Currently Amended) A method as recited in claim 13, further 
comprising: 

copying substantially all data packets when in the first mode . 

15. (Currently Amended) A method as recited in claim 14, wherein in the 
first mode, copying by Ihe a.traffic controller substantially all data packets 
included in the network traffic; and 

forwarding the copied data packets to the a virus/worm analyzer unit. 
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16. (Currently Amended) A method as recited in claim 15, comprising: 

forwarding the copied data packet to a packet protocol determinator; and 
determining if the packet protocol of the copied data packet is of a first set 

i 

j of protocols one lik e ly to b e infootod by th e d e t e ct e d comput e r virus or comput e r 

j 

i worm . 

f 

17. (Currently Amended) A method as recited in claim 16, further 
comprising: 

receiving at a trash collector those copied data packets determined to be of a 
second set of protocols not likely to bo infected by the dotootod comput e r virus or 
computer worm ; and 

receiving and analyzing those copied data packets determined to be of €^ the 
second set of protocol lik e ly to bo infootod by the dot e otod comput e r virus or 
computer worm at a filescan unit. 

18. (Original) A method as recited in claim 17, further comprising: 
determining by a virus/worm analyzer unit if those copied data packets 

received at the filescan unit are infected by the detected computer virus or 
computer worm; 

I forwarding those packets determined not to be infected to the trash collector; 

analyzing the infected copied data packets; and 
generating a virus report based upon the analysis. 
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19. (Original) A method as recited in claim 14 comprising: 
wherein in the second mode, 

forwarding only those original data packets included in the network traffic 
suspected of being infected by the detected computer virus or computer 
worm are to the virus/worm analyzer unit. 

20. (Currently Amended) A method as recited in claim 19, at the virus/worm 
analyzer unit, forwarding the original data packet to a packet protocol 
determinator; and 

determining if the packet protocol of the copied data packet is of a second 
set of protocols on e likoly to bo infootod by th e d e tected oomputcr virus or 
computer worm . 

21. (Currently Amended) A method as recited in claim 20, further 
comprising: 

returning to the network traffic only those original data packets determined 
to be of the second set of protocols a protocol not likoly to be infootod by tho 
dotootod oomputcr virug or oomputcr worm ; and 

analyzing those original data packets determined to be of a specific protocol likoly 
to bo infootod by tho dotootod computer virus or oomputor worm , 

22. (Currently Amended) A method as recited in claim 21 comprising: 
determining if those original data packets received at ^he a filescan unit are 
infected by the detected computer virus or computer worm forwarding those 
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packets determined not to be infected are to the network interface for return 
to the network traffic; and 

generating a virus report based upon the analysis. 

23. (Original) A monitor as recited in claim 13, wherein the first mode is an 
inline mode and wherein the second mode is a standby mode. 

24-33 (Cancelled) 
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